copilot-sdk
Enables developers to build applications using GitHub Copilot SDK for seamless integration across multiple programming languages.
Install this skill
Security score
The copilot-sdk skill was audited on May 15, 2026 and we found 20 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 305 | modifiedPrompt: `[User from engineering team] ${input.prompt}`, |
Template literal with variable interpolation in command context
| 320 | console.log(`Session ${invocation.sessionId} started (${input.source})`); |
Template literal with variable interpolation in command context
| 399 | ```typescript |
Template literal with variable interpolation in command context
| 767 | ```yaml |
Access to hidden dotfiles in home directory
| 622 | Session state is saved to `~/.copilot/session-state/{sessionId}/`: |
Access to hidden dotfiles in home directory
| 797 | - Persistent storage: mount `~/.copilot/session-state/` for containers |
Access to root home directory
| 775 | - session-data:/root/.copilot/session-state |
Access to .env file
| 471 | const client = new CopilotClient({ githubToken: process.env.GITHUB_TOKEN }); |
Access to .env file
| 506 | provider: { type: "openai", baseUrl: "https://api.openai.com/v1", apiKey: process.env.OPENAI_API_KEY } |
Access to .env file
| 514 | apiKey: process.env.FOUNDRY_API_KEY, |
Access to .env file
| 524 | apiKey: process.env.AZURE_OPENAI_KEY, |
Access to .env file
| 531 | provider: { type: "anthropic", baseUrl: "https://api.anthropic.com", apiKey: process.env.ANTHROPIC_API_KEY } |
External URL reference
| 404 | url: "https://api.githubcopilot.com/mcp/", |
External URL reference
| 506 | provider: { type: "openai", baseUrl: "https://api.openai.com/v1", apiKey: process.env.OPENAI_API_KEY } |
External URL reference
| 513 | baseUrl: "https://your-resource.openai.azure.com/openai/v1/", |
External URL reference
| 523 | baseUrl: "https://my-resource.openai.azure.com", // Just the host — no /openai/v1 |
External URL reference
| 531 | provider: { type: "anthropic", baseUrl: "https://api.anthropic.com", apiKey: process.env.ANTHROPIC_API_KEY } |
External URL reference
| 536 | provider: { type: "openai", baseUrl: "http://localhost:11434/v1" } |
External URL reference
| 559 | token = credential.get_token("https://cognitiveservices.azure.com/.default").token |
External URL reference
| 902 | - [MCP Protocol Specification](https://modelcontextprotocol.io) |